It's really not that much money per card for just the Heartland breach alone, even if you assume only a fraction of cards were actually being used.
The Heartland breach was discovered after card companies found a pattern of chargebacks over a number of months. If the cards hadn't been used, the breach likely would have been undiscovered, for years, if at all. It took Heartland months of investigation to find internal evidence they had been breached. The attackers had long since left and attempted to erase their tracks.
It's really not that much money per card for just the Heartland breach alone, even if you assume only a fraction of cards were actually being used.
The Heartland breach was discovered after card companies found a pattern of chargebacks over a number of months. If the cards hadn't been used, the breach likely would have been undiscovered, for years, if at all. It took Heartland months of investigation to find internal evidence they had been breached. The attackers had long since left and attempted to erase their tracks.